Our Privacy Policy
Version 1.0 | 31.03.26
Contents:
Who we are
Data we collect and why
The lawful basis for processing your data
How we use your data
How long we keep your data
How we keep your data secure
Your rights
Cookies
Complaints
Changes to this policy
1. Who we are
Elgon Social Research is an independent social research agency specialising in deliberative and participatory research. We are registered in England
and Wales under company number 13886505. For the purpose of UK data protection law, Elgon Social Research is the data controller for the personal
data we collect and process. Depending on the nature of the projects, we may act as sole data controller or as joint data controller alongside a
research partner. Where this is the case, the respective responsibility of each party would be set out in a data sharing agreement and communicated
to participants via the consent form and privacy notice.
Data contact: If you have any questions about this policy or how we handle your personal data, please contact our data team. We will respond to all
queries within one calendar month.
Email: admin@elgon.social
Elgon Social Research’s formal data protection officer is Reema Patel, Our data team is responsible for data protection queries and for ensuring we
meet our obligations under UK GDPR and the MRS Code of Conduct.
2. What data we collect and why
We only collect personal data that is necessary for the purpose of our research projects and business operations.
Research participants - personal details
Name and contact details: used to manage your participation in a research project
Demographic information such as age, religion, and occupation: used to ensure a representative sample
Research participants - research materials
Responses, views, and contributions: gathered during research sessions
Audio or visual recordings of sessions: where you have given your consent
Transcripts derived from recordings: which are anonymised before use in analysis and reporting
Images or quotes attributable to you: where you have given your specific consent
Where Elgon Social hold research materials directly, these are stored securely and handled in accordance with the same standards as all other
personal data. Where research materials are held by a partner organisation. This will be clearly stated in the project consent form.
Website visitors and enquiries
Name and contact details provided when you get in touch with us
Basic analytics data: such as pages visited and time spent on site, collected when you visit our website.
3. The Lawful basis for processing your data
We process personal data under the following lawful bases set out in UK GDPR Article 6:
Consent: where you have given clear, informed consent, for example to be recorded for identified in research outputs
Legitimate interested: where processing is necessary for the purpose of our research and we have assessed that your interested and rights are not overridden
Contract: where processing is necessary to fulfil a contractual obligation, for example arranging participation payments or reimbursements.
Special category data
We will never collect or process special category data without your express permission. Special category data includes information about your health, ethnicity, religion, political opinions, sexual orientation, or biometric data.
Where special category data may be apparent from your contributions or images, for example where your ethnicity or health may be identifiable, we rely on explicit consent under UK GDPR Article 9(2)(a). This will always be sought separately and clearly explained before any such data is collected.
4. Who we share your data with
We do not sell your personal data or share it with third parties for their own purposes. We may share data in the following limited circumstances:
Research clients and partners: anonymised or aggregated findings only, unless you have specifically consented to identified use. Personal data is never shared with clients in a form that could identify you without your explicit consent.
Research materials: where Elgon Social Research holds recordings, transcripts, or other research materials, these will only be shared with the research client or partner in anonymised or aggregated form unless you have specifically consented to identified use. Raw recordings and unanonymised transcripts will never be shared with clients.
Research partners: where a project is delivered in partnership with another organisation, data sharing is governed by a formal data sharing agreement and both parties are bound by UK GDPR and the MRS Code of Conduct.
Service providers: we work with a small number of trusted third-party providers to support our operations, such as secure file storage, video conferencing, and payment processing. These providers act as data processors on our behalf and are contractually required to handle your data securely and only for the purposes we specify.
Legal obligations: we may disclose data where required to do so by law.
5. How long we keep your data
We only keep personal data for as long as necessary for the purpose for which it was collected.
Participant contact details: deleted within 12 months of project completion.
Research materials (recordings, transcripts, responses): deleted within 12 weeks or months of project completion, or once analysis is complete,
whichever is sooner.
Anonymised transcripts and aggregated findings: retained for 3 years for audit and quality assurance purposes.
Images and attributed quotes (where consent has been given): retained for the lifetime of the published output, reviewed at 3 years.
Financial records: retained for 7years in line with HMRC requirements.
Once data is no longer needed, it is deleted securely or anonymised so that it can no longer be linked back to you.
6. How we keep your data safe
We take the security of your personal data seriously. Our measures include:
Encrypted file storage
Access controls so that only authorised team members can access personal data
Secure deletion of data when retention periods expire
Regular review of our data handling practices
Use of vetted third-party transcription and processing services bound by data processing agreements
We follow the MRS Code of Conduct 2023 in all our research operations, which sets out professional standards for the collection, handling, and
protection of research data. We are working towards MRS Fair Data accreditation as part of our ongoing commitment to best practice.
7. Your rights
Under UK GDPR you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at
admin@elgon.social and we will respond within one calendar month.
Access: you can request a copy of the personal data we hold about you.
Rectification: you can ask us to correct any inaccurate or incomplete data.
Erasure: you can ask us to delete your data where there is no longer a lawful basis for holding it.
Restriction: you can ask us to restrict how we use your data in certain circumstances.
Objection: you can object to processing based on legitimate interests
Portability: you can ask for your data in a portable format where processing is based on consent or contract.
Withdraw consent: where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out
before withdrawal.
8. Cookies
Our website uses cookies to support basic functionality and understand how visitors use the site.
9. Complaints
If you have a concern about how we have handled your personal data, please contact us in the first instance at admin@elgon.social and we will do
our best to resolve it.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent data protection authority:
Website: ico.org.uk
Telephone: 0303 123 1113
10. Changes to this policy
We may update this policy from time to time. The current version will always be available and the version number and date at the top of this page will reflect any changes.